← All changes | includes/generators/get-from-db.php +63 -6 3.6.1 → 3.6.6 View file →

		@@ -73,10 +73,10 @@
73	73	public function get_auto_update_context_fields(): array {
74	74	return array(
75	75	array(
76	76	'single' => true,
77		- 'description' => __( 'The Trigger Field value is used as the Meta Key and overrides the static setting above. If the Trigger Field is empty, the static Meta Key is used.', 'jet-form-builder' ),
78		- 'example' => __( 'Choose the field whose value will be used as the dynamic Meta Key.', 'jet-form-builder' ),
	77	+ 'description' => __( 'The Trigger Field value can switch the Meta Key when it matches a saved Trigger Field choice or an allowed server-side key. Otherwise the static Meta Key is used.', 'jet-form-builder' ),
	78	+ 'example' => __( 'Choose the field whose saved option values should be allowed as dynamic Meta Keys.', 'jet-form-builder' ),
79	79	),
80	80	);
81	81	}
82	82
		@@ -99,9 +99,10 @@
99	99	}
100	100
101	101	/**
102	102	* Generate options with context from dependent fields.
103		- * Uses the watched field value as meta key.
	103	+ * Context may override the meta key only when the candidate value is
	104	+ * explicitly allowed by saved field choices or server-side filters.
104	105	*
105	106	* @param array $settings Parsed settings.
106	107	* @param array $context ['field_name' => 'value'] from listened fields.
107	108	*
		@@ -111,16 +112,72 @@
111	112	if ( ! empty( $context ) ) {
112	113	$context_value = reset( $context );
113	114	$meta_key = is_scalar( $context_value ) ? trim( sanitize_text_field( (string) $context_value ) ) : '';
114	115
115		- // Use watched field value as override only when it is non-empty.
116		- // Otherwise keep static meta_key from generator settings.
117	116	if ( '' !== $meta_key ) {
118		- $settings['meta_key'] = $meta_key;
	117	+ $runtime = $settings['_jfb_runtime'] ?? array();
	118	+ $block_attrs = $settings['_jfb_block_attrs'] ?? array();
	119	+ $validate_dynamic = apply_filters(
	120	+ 'jet-form-builder/generators/get-from-db/validate_dynamic_meta_key',
	121	+ true,
	122	+ $meta_key,
	123	+ $settings,
	124	+ $context,
	125	+ $runtime,
	126	+ $block_attrs
	127	+ );
	128	+
	129	+ if ( ! $validate_dynamic ) {
	130	+ $settings['meta_key'] = $meta_key;
	131	+
	132	+ return $this->generate( $settings );
	133	+ }
	134	+
	135	+ $allowed_meta_keys = $runtime['allowed_meta_keys'] ?? array();
	136	+ $allowed_meta_keys = apply_filters(
	137	+ 'jet-form-builder/generators/get-from-db/allowed-meta-keys',
	138	+ $allowed_meta_keys,
	139	+ $meta_key,
	140	+ $settings,
	141	+ $context,
	142	+ $runtime,
	143	+ $block_attrs
	144	+ );
	145	+ $allowed_meta_keys = $this->sanitize_meta_keys_allowlist( $allowed_meta_keys );
	146	+
	147	+ if ( in_array( $meta_key, $allowed_meta_keys, true ) ) {
	148	+ $settings['meta_key'] = $meta_key;
	149	+ }
119	150	}
120	151	}
121	152
122	153	return $this->generate( $settings );
	154	+ }
	155	+
	156	+ /**
	157	+ * Sanitize an allowlist of meta keys received from runtime or filters.
	158	+ *
	159	+ * @param mixed $allowed_meta_keys Meta keys allowlist.
	160	+ *
	161	+ * @return array
	162	+ */
	163	+ private function sanitize_meta_keys_allowlist( $allowed_meta_keys ): array {
	164	+ if ( ! is_array( $allowed_meta_keys ) ) {
	165	+ return array();
	166	+ }
	167	+
	168	+ $allowed_meta_keys = array_filter(
	169	+ array_map(
	170	+ static function ( $meta_key ) {
	171	+ return is_scalar( $meta_key )
	172	+ ? trim( sanitize_text_field( (string) $meta_key ) )
	173	+ : '';
	174	+ },
	175	+ $allowed_meta_keys
	176	+ )
	177	+ );
	178	+
	179	+ return array_values( array_unique( $allowed_meta_keys ) );
123	180	}
124	181
125	182	/**
126	183	* Returns generated options list.